@wrongstack/core 0.309.0 → 0.310.0

package/dist/storage/plan-store.d.ts

@@ -1,5 +1,5 @@
 import type { ConversationState } from '../core/conversation-state.js';
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 /**
  * Plan items are the strategic counterpart to todos. Where `ctx.todos`
  * is the moment-to-moment task board the LLM mutates per-turn, a plan

package/dist/storage/queue-store.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 import type { ContentBlock } from '../types/blocks.js';
 import type { Logger } from '../types/logger.js';
 /**

package/dist/storage/replay-log-store.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 import type { Request, Response } from '../types/provider.js';
 /**
  * ReplayLogStore — sidecar store for deterministic-replay support

package/dist/storage/session-recovery.d.ts

@@ -43,6 +43,8 @@ export interface RecoveryPlan {
     context: string | null;
 }
 export interface InterruptedToolDetail {
+    /** Tool_use id — lets callers synthesize a matching error tool_result. */
+    id?: string | undefined;
     name: string;
     argsSummary?: string | undefined;
     ts?: string | undefined;
@@ -64,6 +66,14 @@ export declare class SessionRecovery {
     private readonly dir;
     private static readonly MAX_PENDING_EVENTS;
     private static readonly MAX_PENDING_BYTES;
+    /**
+     * Build a recovery plan from ALREADY-LOADED events without touching disk.
+     * executeResumeSession uses this because load() has already paid for the
+     * transcript read; recover()'s file scan would duplicate it.
+     */
+    static buildRecoveryPlan(events: readonly SessionEvent[], 
+    /** Canonical session id — threaded through so RecoveryPlan stays complete. */
+    sessionId: string): RecoveryPlan;
     /**
      * Scan a session log and return a `StaleSession` if and only if the newest
      * lifecycle boundary is an `in_flight_start` without a later

package/dist/storage/session-resume-validation.d.ts

@@ -13,7 +13,19 @@ export declare function validateResumeFileObservations(events: readonly SessionE
  * strips previous notices from the replayed conversation before appending the
  * current ones; these prefixes are how it recognizes them.
  */
-export declare const RESUME_NOTICE_HEADERS: readonly ['[SESSION RESUME FILE VALIDATION]', '[SESSION RESUME INTERRUPTED WORK]'];
+export declare const RESUME_NOTICE_HEADERS: readonly ['[SESSION RESUME FILE VALIDATION]', '[SESSION RESUME INTERRUPTED WORK]', '[SESSION RESUME CRASH RECOVERY]'];
+/**
+ * Build the ephemeral system message shown when the resumed session's newest
+ * lifecycle boundary was a dangling `in_flight_start` — i.e. the previous
+ * process died mid-iteration. Lists the interrupted tool calls that were
+ * stripped from the restored conversation (adjacency repair) so the model
+ * can decide whether to retry.
+ * Returns null when the session did not crash.
+ */
+export declare function formatCrashRecoveryNotice(interruptedTools: ReadonlyArray<{
+    name: string;
+    argsSummary?: string | undefined;
+}>, lastContext: string | null): string | null;
 /**
  * True for a system message this module produced on an earlier resume.
  *

package/dist/storage/session-store/events.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../../kernel/events.js';
+import type { EventBus } from '../event-bus-port.js';
 export type SessionStoreReadOperation = 'load' | 'load_events_only' | 'list' | 'summary' | 'index_read';
 export type SessionStoreWriteOperation = 'create' | 'resume' | 'rename' | 'append' | 'flush' | 'close' | 'index_append' | 'compact' | 'checkpoint';
 export type SessionStoreOutcome = 'success' | 'failure';

package/dist/storage/session-store/load-session-data.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../../kernel/events.js';
+import type { EventBus } from '../event-bus-port.js';
 import type { SecretScrubber } from '../../types/secret-scrubber.js';
 import type { SessionData } from '../../types/session.js';
 /**

package/dist/storage/session-store/rename-session.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../../kernel/events.js';
+import type { EventBus } from '../event-bus-port.js';
 import type { SecretScrubber } from '../../types/secret-scrubber.js';
 import type { SessionSummary } from '../../types/session.js';
 export interface RenameSessionParams {

package/dist/storage/session-store/resume-session.d.ts

@@ -1,5 +1,5 @@
 import * as fsp from 'node:fs/promises';
-import type { EventBus } from '../../kernel/events.js';
+import type { EventBus } from '../event-bus-port.js';
 import type { SecretScrubber } from '../../types/secret-scrubber.js';
 import type { ResumedSession, SessionData, SessionEvent, SessionSummary } from '../../types/session.js';
 import type { SessionCheckpointCas } from '../session-checkpoint-cas.js';
@@ -20,6 +20,8 @@ export interface ResumeSessionParams {
     }>>;
     persistCatalogSummary: (summary: SessionSummary) => Promise<void>;
     logWarn: (msg: string, ctx?: Record<string, unknown>) => void;
+    /** Store root used to rescan the full transcript when load() dropped events. */
+    sessionsDir?: string | undefined;
 }
 export declare function executeResumeSession(params: ResumeSessionParams): Promise<ResumedSession>;
 export declare function openSessionForAppend(file: string): Promise<fsp.FileHandle>;

package/dist/storage/session-store/session-store-index.d.ts

@@ -7,7 +7,8 @@ export declare function appendToIndexStrict(dir: string, indexFile: string, summ
 export declare function writeTombstone(dir: string, indexFile: string, id: string, invalidateShard: (id: string) => Promise<void>, onTombstone: () => void): Promise<void>;
 export declare function readIndexFile(indexFile: string, currentCache: IndexCacheEntry | null): Promise<{
     summaries: readonly SessionSummary[];
+    deletedIds: ReadonlySet<string>;
     cache: IndexCacheEntry | null;
 }>;
-export declare function compactIndexInner(indexFile: string, entries: readonly SessionSummary[]): Promise<void>;
+export declare function compactIndexInner(indexFile: string, entries: readonly SessionSummary[], deletedIds?: ReadonlySet<string>): Promise<void>;
 //# sourceMappingURL=session-store-index.d.ts.map

package/dist/storage/session-store/types.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../../kernel/events.js';
+import type { EventBus } from '../event-bus-port.js';
 import type { Logger } from '../../types/logger.js';
 import type { SecretScrubber } from '../../types/secret-scrubber.js';
 import type { SessionData, SessionEvent, SessionSummary } from '../../types/session.js';

package/dist/storage/session-store.d.ts

@@ -16,6 +16,28 @@ export declare class DefaultSessionStore implements SessionStore {
     private readonly _loadCache;
     private readonly loadCache;
     private _indexCache;
+    /**
+     * Tombstoned ids — hidden even if their JSONL remains on disk.
+     * Convention: readIndex() REASSIGNS this set from the parsed index file
+     * MERGED with _manualTombstones; writeTombstone() adds in-place immediately
+     * so an incremental cache rebuild can never resurrect a just-deleted
+     * session.
+     */
+    private _indexDeletedIds;
+    /**
+     * Tombstones added by THIS store between reads. Merged into every fresh
+     * snapshot so a read racing writeTombstone cannot drop an in-flight
+     * deletion; entries are pruned once the parsed index file itself carries
+     * them.
+     */
+    private readonly _manualTombstones;
+    /**
+     * File-truth tombstones from the last readIndex() parse (EXCLUDES
+     * _manualTombstones additions). compactIndexInner persists THIS snapshot so
+     * concurrent writeTombstones that landed after the parse are not written
+     * prematurely — they persist through their own append path instead.
+     */
+    private _indexFileDeletedIds;
     private readonly shardManifestCache;
     private static readonly LIST_SCAN_CONCURRENCY;
     private indexAppendCount;
@@ -30,6 +52,17 @@ export declare class DefaultSessionStore implements SessionStore {
     private shardKeyForSessionId;
     private invalidateShardManifestBySessionId;
     private ensureShardDir;
+    /**
+     * Create a fresh session writer.
+     *
+     * @threadSafety Failure-prone steps (manifest invalidation, sidecar
+     * removal, catalog upsert, the durable `{action:'create'}` index row)
+     * run BEFORE the truncating `'w'` open, so no rejection path can destroy
+     * prior bytes. Ordinary index summary rows never undelete a tombstone
+     * (the parser only honors `{action:'create'}`), so a swallowed create-row
+     * would leave a live writer whose id stays hidden forever — that append
+     * is therefore required, not best-effort.
+     */
     create(meta: Omit<SessionMetadata, 'startedAt'>): Promise<SessionWriter>;
     fork(id: string, opts?: SessionForkOptions): Promise<ForkedSession>;
     readRawEvents(id: string): Promise<SessionEvent[]>;
@@ -63,8 +96,45 @@ export declare class DefaultSessionStore implements SessionStore {
     private persistCatalogSummary;
     private writeTombstone;
     private compactIndex;
+    /**
+     * Compact the local index in place.
+     *
+     * Contract carried into the shared compactIndexInner helper
+     * (session-store-index.ts): `entries` MUST already exclude tombstoned ids,
+     * and the deleted-set argument is persisted VERBATIM — neither the helper
+     * nor its callers may resurrect filtered rows or invent deletions.
+     * Locking: callers MUST already hold the indexFile lock (both do:
+     * compactIndex() below and the appendToIndexStrict compaction hook);
+     * readIndex() inside reads that same locked file, so no second lock may
+     * be taken here (non-reentrant → deadlock).
+     *
+     * That same lock is what makes the _indexFileDeletedIds snapshot safe to
+     * pass across the await below: writeTombstone() appends under the identical
+     * non-reentrant indexFile lock, so no tombstone can land between our
+     * readIndex() and the snapshot handed to the helper. Compaction would
+     * otherwise be racing a delete it cannot see.
+     */
     private compactIndexInner;
     private readIndex;
+    /**
+     * Merge close-time index rows with directory-scan results, keyed by id.
+     * Scanned entries win — their metadata is re-derived from the transcript,
+     * so it reflects mid-session activity that index rows (written on close)
+     * cannot know about. Indexed-only ids fill gaps; duplicates within the
+     * index resolve last-wins, matching append order.
+     */
+    private mergeIndexWithScan;
+    /**
+     * Rebuild the index from what is actually on disk.
+     *
+     * @returns the number of healthy, live entries in the rebuilt index. Both
+     * backends report that same quantity: ids whose summary could not be derived
+     * are excluded (the catalog counts them as `damaged`; the local scan drops
+     * them when `summaryFor` rejects), and ids carrying a surviving tombstone are
+     * excluded (the catalog rebuilds only from live files; the local branch skips
+     * them explicitly). It is NOT a count of rows written to the file — tombstone
+     * rows are persisted but never counted.
+     */
     rebuildIndex(): Promise<number>;
     private listFromDirectoryScan;
     private collectShardKeys;

package/dist/storage/session-summary-tracker.d.ts

@@ -30,6 +30,14 @@ export declare class SessionSummaryTracker {
     private openToolUses;
     constructor(opts: SessionSummaryTrackerOptions);
     get currentSummary(): Readonly<SessionSummary>;
+    /**
+     * Non-destructive materialization of every live counter into a summary
+     * snapshot. Unlike finalize(), it stamps no endedAt, applies no final
+     * outcome, and resolves no name — mid-session metadata checkpoints use it
+     * so a killed process leaves accurate listing metadata behind without
+     * pretending the session ended cleanly.
+     */
+    snapshot(): SessionSummary;
     get pendingToolUses(): string[];
     observe(event: SessionEvent): void;
     recomputeFromDisk(filePath: string): Promise<void>;

package/dist/storage/session-write-buffer.d.ts

@@ -1,5 +1,5 @@
 import * as fsp from 'node:fs/promises';
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 import type { SessionEvent } from '../types/session.js';
 export interface SessionWriteBufferOptions {
     sessionId: string;
@@ -9,6 +9,17 @@ export interface SessionWriteBufferOptions {
     events?: EventBus | undefined;
     getTraceId?: () => string | undefined;
 }
+/**
+ * Options for explicit (immediate-path) flushes.
+ */
+export interface FlushBufferOptions {
+    /**
+     * fsync-level durability after the append lands: disk-durable rather than
+     * only page-cache durable (SIGKILL survives page cache; power loss does
+     * not). Best-effort — a failed datasync never fails the flush itself.
+     */
+    datasync?: boolean;
+}
 export declare class SessionWriteBuffer {
     private readonly opts;
     private static readonly FLUSH_INTERVAL_MS;
@@ -24,18 +35,36 @@ export declare class SessionWriteBuffer {
     private lastAppendWarnAt;
     private writeChain;
     private flushPromise;
+    /**
+     * Batch currently inside enqueueWrite. `flushSync` may steal it if the
+     * async append has not started, so a dying process writes in-flight +
+     * remaining buffer as one ordered append instead of racing a second fd.
+     */
+    private inFlight;
     constructor(opts: SessionWriteBufferOptions);
     get isClosed(): boolean;
     get length(): number;
     private eventBytes;
     push(event: SessionEvent): boolean;
     enqueueWrite(data: string): Promise<void>;
+    private enqueueFlight;
     scheduleFlush(isClosed?: boolean): void;
     cancelTimer(): void;
-    flushBuffer(isClosed?: boolean): Promise<void>;
+    flushBuffer(isClosed?: boolean, opts?: FlushBufferOptions): Promise<void>;
     private flushBufferOnce;
     drainWriteChain(): Promise<void>;
     drainFlushPromise(): Promise<void>;
+    /**
+     * Last-gasp synchronous append (SIGKILL/SIGTERM traps, `process.on('exit')`).
+     *
+     * Failure contract: nothing is discarded before the write is known to have
+     * landed. Buffered events stay in `writeBuffer` — it is cleared only after
+     * `fsyncSync` returns — and a stolen in-flight batch is handed back to the
+     * async write chain, so a survivable failure (EACCES, ENOSPC, EMFILE) loses
+     * nothing. Failure is never silent: a structured `session.flush_sync_failed`
+     * warning names exactly what was still pending, which is what SIGKILL-trap
+     * tests assert against.
+     */
     flushSync(): void;
     clear(): void;
     shouldFlushNow(): boolean;

package/dist/storage/task-store.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 import type { TaskItem } from '../utils/task-format.js';
 export interface TaskFile {
     version: 1;

package/dist/storage/todos-checkpoint.d.ts

@@ -1,6 +1,6 @@
 import type { TodoItem } from '../core/context.js';
 import type { ConversationState } from '../core/conversation-state.js';
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 /**
  * On-disk checkpoint for `ctx.todos`. Written atomically every time the
  * todo list changes, read once on session resume. This is the missing

package/dist/storage/tool-audit-log.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 /**
  * ToolAuditLog — idea #9 from IDEAS.md.
  *

package/dist/tasking/index.js

@@ -232,6 +232,13 @@ var TaskTracker = class _TaskTracker {
   graph = null;
   transitions = [];
   listeners = [];
+  /**
+   * Re-entrancy guard for status cascades: true while an auto-block /
+   * auto-unblock cascade is running. Listener-driven mutations during a
+   * cascade still record their own primary transition — only their
+   * cascading is skipped (prevents unbounded recursion).
+   */
+  cascading = false;
   static MAX_TRANSITIONS = 1e4;
   /**
    * Subscribe to live task mutations (add / update / status change). Returns an
@@ -307,6 +314,28 @@ var TaskTracker = class _TaskTracker {
         message: "No graph loaded",
         code: ERROR_CODES.SDD_INVALID_STATE
       });
+    if (!this.graph.nodes.has(from) || !this.graph.nodes.has(to)) {
+      throw new SddError({
+        message: `Cannot add ${type} edge ${from} -> ${to}: endpoint task is not in the graph`,
+        code: ERROR_CODES.SDD_NOT_READY,
+        context: { from, to, type }
+      });
+    }
+    if (from === to) {
+      throw new SddError({
+        message: `Cannot add ${type} edge: self-loop on task ${from}`,
+        code: ERROR_CODES.SDD_INVALID_STATE,
+        context: { nodeId: from, type }
+      });
+    }
+    if (this.graph.edges.some((e) => e.from === from && e.to === to && e.type === type)) return;
+    if (type === "depends_on" && this.dependsOnTransitively(from, to, /* @__PURE__ */ new Set())) {
+      throw new SddError({
+        message: `Cannot add depends_on edge ${from} -> ${to}: it would create a dependency cycle`,
+        code: ERROR_CODES.SDD_INVALID_STATE,
+        context: { from, to }
+      });
+    }
     this.graph.edges.push({
       id: crypto.randomUUID(),
       from,
@@ -407,7 +436,7 @@ var TaskTracker = class _TaskTracker {
     if (status === "in_progress") {
       node.startedAt = now;
     }
-    this.transitions.push({ from, to: status, timestamp: now, reason });
+    this.transitions.push({ nodeId: id, from, to: status, timestamp: now, reason });
     if (this.transitions.length > _TaskTracker.MAX_TRANSITIONS) {
       this.transitions.splice(0, this.transitions.length - _TaskTracker.MAX_TRANSITIONS);
     }
@@ -423,7 +452,7 @@ var TaskTracker = class _TaskTracker {
       type: "status_changed",
       nodeId: id,
       node,
-      transition: { from, to: status, timestamp: now, reason }
+      transition: { nodeId: id, from, to: status, timestamp: now, reason }
     });
   }
   updateNode(id, patch) {
@@ -514,40 +543,89 @@ var TaskTracker = class _TaskTracker {
     }
     return computeTaskProgress(this.graph);
   }
-  getTransitions(_taskId) {
-    return [...this.transitions];
+  /**
+   * Recorded transitions in insertion order (oldest first — the array is
+   * trimmed from the front). With `taskId`, only that task's transitions are
+   * returned, still oldest-first; a consumer wanting newest-first reverses
+   * the result. Per-task filtering is possible because every TaskTransition
+   * carries `nodeId` (BIZ-005).
+   */
+  getTransitions(taskId) {
+    return taskId === void 0 ? [...this.transitions] : this.transitions.filter((t) => t.nodeId === taskId);
+  }
+  /**
+   * Record a cascade-driven status change (BIZ-003): mutate the node, push a
+   * TaskTransition, persist, and notify subscribers — the same effects an
+   * explicit updateNodeStatus produces — so the board projector's live
+   * snapshot and the transition log observe auto-block/auto-unblock.
+   */
+  recordCascadeStatusChange(nodeId, node, to, reason) {
+    const from = node.status;
+    if (from === to) return;
+    const now = Date.now();
+    node.status = to;
+    node.updatedAt = now;
+    if (this.graph) this.graph.updatedAt = now;
+    this.transitions.push({ nodeId, from, to, timestamp: now, reason });
+    if (this.transitions.length > _TaskTracker.MAX_TRANSITIONS) {
+      this.transitions.splice(0, this.transitions.length - _TaskTracker.MAX_TRANSITIONS);
+    }
+    this.persist();
+    this.notifyChange({
+      type: "status_changed",
+      nodeId,
+      node,
+      transition: { nodeId, from, to, timestamp: now, reason }
+    });
   }
   unblockDependents(completedId) {
-    if (!this.graph) return;
-    const dependents = this.getDependents(completedId);
-    for (const depId of dependents) {
-      const dep = this.graph.nodes.get(depId);
-      if (dep?.status === "blocked") {
+    if (!this.graph || this.cascading) return;
+    this.cascading = true;
+    try {
+      const dependents = this.getDependents(completedId);
+      for (const depId of dependents) {
+        const dep = this.graph.nodes.get(depId);
+        if (dep?.status !== "blocked") continue;
         const remainingBlockers = this.getBlockers(depId);
         const allUnblocked = remainingBlockers.every((id) => {
           const blocker = this.graph?.nodes.get(id);
           return blocker?.status === "completed" || blocker?.status === "failed";
         });
         if (allUnblocked) {
-          dep.status = "pending";
-          dep.updatedAt = Date.now();
+          this.recordCascadeStatusChange(
+            depId,
+            dep,
+            "pending",
+            `auto-unblocked: blocker ${completedId} reached a terminal state`
+          );
         }
       }
+    } finally {
+      this.cascading = false;
     }
   }
   checkAndBlockIfNeeded(taskId) {
-    if (!this.graph) return;
-    const blockers = this.getBlockers(taskId);
-    const someBlocked = blockers.some((id) => {
-      const blocker = this.graph?.nodes.get(id);
-      return blocker?.status !== "completed" && blocker?.status !== "failed";
-    });
-    if (someBlocked) {
-      const node = this.graph.nodes.get(taskId);
-      if (node) {
-        node.status = "blocked";
-        node.updatedAt = Date.now();
+    if (!this.graph || this.cascading) return;
+    this.cascading = true;
+    try {
+      const blockers = this.getBlockers(taskId);
+      const incomplete = blockers.filter((id) => {
+        const blocker = this.graph?.nodes.get(id);
+        return blocker?.status !== "completed" && blocker?.status !== "failed";
+      });
+      if (incomplete.length > 0) {
+        const node = this.graph.nodes.get(taskId);
+        if (node) {
+          this.recordCascadeStatusChange(
+            taskId,
+            node,
+            "blocked",
+            `auto-blocked: incomplete blocker(s) ${incomplete.join(", ")}`
+          );
+        }
       }
+    } finally {
+      this.cascading = false;
     }
   }
   /**

package/dist/tasking/task-tracker.d.ts

@@ -20,6 +20,8 @@ export interface TaskTrackerOptions {
     onPersistError?: ((err: unknown) => void) | undefined;
 }
 export interface TaskTransition {
+    /** The task the transition applies to — required for per-task filtering. */
+    nodeId: string;
     from: TaskNode['status'];
     to: TaskNode['status'];
     timestamp: number;
@@ -39,6 +41,13 @@ export declare class TaskTracker {
     private graph;
     private transitions;
     private listeners;
+    /**
+     * Re-entrancy guard for status cascades: true while an auto-block /
+     * auto-unblock cascade is running. Listener-driven mutations during a
+     * cascade still record their own primary transition — only their
+     * cascading is skipped (prevents unbounded recursion).
+     */
+    private cascading;
     private static readonly MAX_TRANSITIONS;
     constructor(opts: TaskTrackerOptions);
     /**
@@ -89,7 +98,21 @@ export declare class TaskTracker {
     getBlockers(taskId: string): string[];
     canStart(taskId: string): boolean;
     getProgress(): TaskProgress;
-    getTransitions(_taskId?: string): TaskTransition[];
+    /**
+     * Recorded transitions in insertion order (oldest first — the array is
+     * trimmed from the front). With `taskId`, only that task's transitions are
+     * returned, still oldest-first; a consumer wanting newest-first reverses
+     * the result. Per-task filtering is possible because every TaskTransition
+     * carries `nodeId` (BIZ-005).
+     */
+    getTransitions(taskId?: string): TaskTransition[];
+    /**
+     * Record a cascade-driven status change (BIZ-003): mutate the node, push a
+     * TaskTransition, persist, and notify subscribers — the same effects an
+     * explicit updateNodeStatus produces — so the board projector's live
+     * snapshot and the transition log observe auto-block/auto-unblock.
+     */
+    private recordCascadeStatusChange;
     private unblockDependents;
     private checkAndBlockIfNeeded;
     /**

package/dist/types/compactor.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../core/context.js';
+import type { AgentContext } from './context.js';
 export interface CompactRepairReport {
     removedToolUses: string[];
     removedToolResults: string[];
@@ -58,7 +58,7 @@ export interface CompactReport {
     } | undefined;
 }
 export interface Compactor {
-    compact(ctx: Context, opts?: {
+    compact(ctx: AgentContext, opts?: {
         aggressive?: boolean | undefined;
     }): Promise<CompactReport>;
 }